Sensitive Personal Data
Categories of personal data that warrant heightened protection due to the elevated risk of harm if misused.
Full Definition
Sensitive Personal Data refers to categories of personal data that carry higher privacy risks and therefore attract stricter protection under data protection laws. Under GDPR Article 9, special categories include: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, and sexual orientation. Processing these categories requires explicit consent or another specific lawful basis. India's DPDP Act uses the concept of personal data that may be notified as requiring additional protection. CCPA's CPRA introduced a 'sensitive personal information' category with opt-out rights. Organisations must identify and apply additional controls to all sensitive data they hold.
How each law treats it
Racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for identification, health data, sex life or sexual orientation. Processing prohibited unless an Article 9(2) condition applies.
The DPDP Act does not create a separate 'sensitive' category. Sensitivity is a factor in the SDF designation test under Section 10.
Sensitive personal information includes SSN, financial account, precise geolocation, racial/ethnic origin, religious beliefs, genetic data, union membership, and more. Consumers can limit use of SPI.
In practice
- Flag sensitive data in the data map so pipelines can treat it specially (encryption at rest, limited log retention, access restrictions).
- Prepare a GDPR Article 9(2) condition for each sensitive-data processing activity. The default is explicit consent; alternatives include employment, substantial public interest, scientific research.
- Treat biometric templates and health identifiers as sensitive even where their use is operational (fingerprint login, mobile health).
Common pitfalls
- Inferring sensitive data from non-sensitive inputs (location pattern → religion, purchase pattern → health). The inference brings the inferred data into scope.
- Mixing sensitive and non-sensitive data in the same log stream without compartmentalisation.
- Over-collecting sensitive data for optional personalisation features.
Frequently asked questions
Is a photograph of a person sensitive data?+
Usually no, unless it is processed with specific techniques to uniquely identify the person — biometric facial recognition then falls under GDPR Article 9. A plain photo is ordinary personal data.
Can I rely on consent for Article 9?+
Explicit consent is one of the Article 9(2) conditions. It must be opt-in, freely given, specific and informed. 'Explicit' is a stronger bar than ordinary Article 6 consent.
Does the CCPA's SPI definition match GDPR's?+
Partially. CCPA adds categories like precise geolocation, government-issued identifiers and SSN that GDPR does not treat as special category. Design to the union of the two if you operate across both.
Related terms
Personal Data
Any information that relates to an identified or identifiable natural person.
DPIA
Data Protection Impact Assessment — a systematic process to identify and minimise privacy risks in new processing activities.
Lawful Basis
A legal justification under GDPR for processing personal data — one of six bases must apply before processing can begin.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes